From veth Pairs to Services: The Secret Life of Container Packets
summary
Follows a real packet from a pod through a Linux network namespace, creating a namespace via unshare and wiring a veth pair with Go and the netlink library, moving the peer into the new namespace, adding routes and iptables entries, then tracing bridges, overlays (UDP encapsulation), routed and VPC-native modes to the destination node. Explains interface indexes like IF13, why MTU 1450 appears, how CNI add/delete/check calls plug plumbing, and how service IPs and NAT map return traffic.
AI-written summary · about
chapters (9)
- 0:00Introduction to container networking
- 2:38Network namespaces explained
- 6:50Creating veth pairs
- 10:37Routing packets between namespaces
- 11:40Handling cross-node traffic
- 13:24Understanding CNI contracts
- 14:32Networking types and MTU
- 16:40Packet journey recap
- 18:05Q&A session
related talks
34mLife of a Packet [I]
23mLife of a Container
17mPod-to-Pod Ping: The Hidden Wiring of Kubernetes
51mHow Kubernetes Networking Really Works: A Packet’s Journey Across Pods and Nodes
40mCloud, Kubernetes, and Service Networking - Taming the Turtles
20mKubernetes Networking 101
26mContainer Networking: The Play of BPF and Network NS with different...
33mWhose Packet Is It Anyway? Life of a Packet Through a Service Mesh